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Abstract. It is well-known that if E is an elliptic curve over the finite field ¥p, then 
E{¥p) ~ Z/mZ X 'L/mk'L for some positive integers m, fc. Let S{M,K) denote the set of 
pairs (m, k) with m < M and k < K such that there exists an elliptic curve over some prime 
finite field whose group of points is isomorphic to Z/mZ x Z/mfcZ. Banks, Pappalardi and 
Shparlinski recently conjectured that ii K < (logAf)^"*^, then a density zero proportion of 
the groups in question actually arise as the group of points on some elliptic curve over some 
prime finite field. On the other hand, if K > (logAf)^^'^, they conjectured that a density 
one proportion of the groups in question arise as the group of points on some elliptic curve 
over some prime finite field. We prove that the first part of their conjecture holds in the full 
range K < (logAf)^"^, and we prove that the second part of their conjecture holds in the 
limited range K > M^"^*^. In the wider range K > NP , we show that a positive density of 
the groups in question actually occur. 

1. Introduction 

Let E be an elliptic curve over Fp, and denote with E{¥p) its set of points over Fp. It is 
well-known that E{¥p) admits the structure of an abelian group. It is then natural to ask for 
a description of the groups that arise this way as p runs through all primes and E through 
all curves over Fp. This question was first addressed by Banks, Pappalardi and Shparlinski 
in [2]. Below we reproduce part of the discussion from p]. 

The first relevant property is that the size of E{¥p) can never be very far from p + 1. 
Indeed, if ^E(¥p) = p + 1 — Op, then Hasse proved that \ap\ < 2y/p. Setting 



X 



X + 1 -2^/x = {y/x - if and x^ := x + 1 + 2^/x = {y/x + if 



for each a; > 1, this is equivalent to saying that ^E{¥p) e {p~ ,P~^)- It follows from the work 
of Deuring [7] that for any integer N satisfying p~ < N < p~^, there exists an elliptic curve 
E/¥p with ^E(¥p) = N. Solving the inequalities for p allows us to conclude that, given a 
positive integer A^, there is a finite field Fp and an elliptic curve E/¥p with ^E(¥p) = N if 
and only if there is a prime p G (A^~, A^"^). However, this result does not take into account 
the actual group structure of E(¥p). 

The second relevant property is that, as an abstract abelian group, E{¥p) has at most two 
invariant factors. In other words, we may write that 

E{¥p) ~ Gm,k ■■= Z/mZ X Z/mkZ 

for some unique positive integers m, k. Refining the ideas already present in the work of 
Deuring, one can argue that there is an elliptic curve E/¥p with -E'(Fp) ~ Gm,k if and 
only if = m'^k G {p~ ,p~^) and p = 1 (modm). Arguing as before allows us to conclude 
that, given a group Gm.k of order A^ = m^k, there is a finite field Fp and an elliptic curve 
E/¥p with -E'(Fp) ~ Gm,k if and only if there is a prime p = l(modm) in the interval 



(A^ ,N~^). The latter condition is equivalent to the assertion that there is a prime of the 
form p = kw? + jm + 1 with \j\ < 2\fk. See Lemma [2.21 below. 

The above characterization gives some interesting consequences. Note that when k is very 
small it is unlikely that there is a finite field Fp and a curve -E/Fp such that -E(Fp) ~ Gm,k 
simply because the interval {N~,N^) is too short. For example, there is no curve over Fp 
such that E{¥p) ~ Z/llZ x Z/llZ, since none of the three integers 122 - 11, 122, 122 + 11 
is prime. Other examples of groups not occurring are given by Banks, Pappalardi, and 
Shparlinski in [2]. 

In order to study the question of which groups Gm,k occur as group structures of elliptic 
curves over Fp from an average point of view, the authors of [2] defined 

S{M, K) := {m < M, k < K : there is a prime p and a curve E/¥p such that -E'(Fp) ~ Gm,k} ■ 
They proved the following result for the cardinality of S{M, K). 

Theorem 1.1 (Banks, Pappalardi, and Shparlinski [2]). Let M > 2 and K > 1. Then for 
every fixed K , we have 



i^S{M,K)<€.K ^ 



IfM< K43/94-e^ ^^g^ 

Finally, if M < K^/"^-', then 



4^S{M, K) > 



logM 

MK 
\ogK' 

MK 



Moreover, the authors of [2] conjectured the following. 
Conjecture 1.2 (Banks, Pappalardi, Shparlinski [2]). 

MK{l + o{l)) ifK>{\ogMf+\ 

The motivation behind the above conjecture can be explained by a simple heuristic. An 
integer n is prime with probability about j^^^^. For G^./c to be the group of a curve E over 

some finite field, we need at least one of the integers n = km? + jm + 1 with |j| < 2\/k to 
be prime. If we assume that these events occur independently of each other, the probability 
that none of the integers n = km^ + jm + 1, |j| < 2a/A;, is prime is about 
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\og{m'^k) 

This quantity becomes less than one as soon as y/k ^ log(m^A;). In particular, if > 
(logm)^"*""^, then we expect with probability 1 that km^ + jm + 1 is prime for some j G 
(-2\/fc,2\/fc). One can make the even bolder guess that if k is large enough, then there is 
always some j G {—2\/k, 2\/k) for which fcm^ +jm + 1 is prime. This question is completely 
out of reach with the current technology, as we do not even know whether there are primes 
in every interval of the form (x, x + x^'^'^'^) with x large enoughQ 



""^The best result known, due to Baker, Harman and Pintz [T], is that (x, a; + x'^^^'^^) contains primes for 
every sufficiently large x. 
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In this paper we improve upon Theorem 11.11 Our first result is that the first part of 
Conjecture 11.21 holds for M, K in the predicted range. 



Theorem 1.3. Let M > 2 and K > 1. Then we have that 



i^S{M, K) « 



i^S{M,K) = MK + 0,^A 



logM 

In particular, if K < (logM)^^'^ for some fixed e > 0, then 

i^S{M, K) = o,{MK) as M oo. 

We also prove that the second part of Conjecture 11.21 holds for a restricted range of M 
and K. 

Theorem 1.4. FixA>l ande>0. If M < K^I^-\ then 

MK 

Finally, we show that a lower bound of the correct order of magnitude also holds in some 
larger range. 

Theorem 1.5. For 1 < M < K^/"^ , we have that 

#S{M, K) > MK. 

Notation. Given an integer n, we let P'^{n) and P~{n) denote its largest and smallest 
primes factors, respectively, with the notational conventions that P~^{1) = 1 and -P~(l) = oo. 
As usually, r, fi, and A denote the divisor, the Mobius, the totient and the von Mangoldt 
function, respectively. Furthermore, we let 7i{x; q, a) be the number of primes up to x that 
are congruent to a (mod q) and 

ilj{x;q,a) := ^ A{n). 

n=a (mod q) 

The letters p and i always denote prime numbers. Finally, we write / <^a,b,... 9 if there is 
a constant c, depending at most on a, 6, ... , such that |/| < eg, and we write / '^a,b,... 9 if 
/ <a,6,... 9 and g <^a,b,- /• 

2. Preliminaries and Cohen-Lenstra heuristics 

In this section we explain how the existence of an elliptic curve over a prime finite field 
with a given group structure is equivalent to the existence of a prime in a certain interval 
with a given congruence condition. Some of the results and arguments of this section are 
very similar to Section 3 of [2], but we reproduce them here for the sake of completeness. 
The first lemma is a result of Riick [12], who used the work of Deuring, Waterhouse, and 
Tate-Honda to characterize those groups which actually occur as the group of points on 
elliptic curves over finite fields. 

Lemma 2.1 (Riick). Let N = Y\e,^^' possible order ^E{¥p) for an elliptic curve E/¥p, 
i.e., N G {p~ iP'^)- Then all the possible groups E{¥p) with ^E{¥p) = N are 

Z/p^^Z X Yl {'^/t'Z X Z/t'~^^Z) 
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where bi are arbitrary integers satisfying < bi < min [vi{p — 1), [^J)- 

As a corollary of the above lemma, we have the following result, which is Lemma 3.5 in [2j. 

Corollary 2.2. Let m and k be integers. There is a prime p and a curve E over ¥p such 
that E{¥p) ~ Gm,k if (md only if there is a prime p = 1 (modm) in the interval 

Im?k '■= {kra^ — 2m\/k + 1, fcm^ + 2my/k + 

or, equivalently, if and only if there is a prime p = km^ + jm + 1 with |j| < 2\/k. 

Proof. Suppose that there exists an elliptic curve E over Fp such that -E(Fp) ~ Gm,fc- As 
mentioned in the introduction, we must have that = rn^k = ^E{¥p) G {p~,p^). Solving 
for p as in the introduction gives that p G (A^~, A^"*") = Imk^- Since the m-torsion points are 
contained in E{¥p) and since the Weil pairing is surjective, ¥p must contain the m-th roots 
of unity, which is equivalent to saying that p = 1 (modm). 

Conversely, suppose that there is a prime p G 1^2^ such that p = l(modm), and let 
N = km^. It is easy to check that |p + 1 — A^| < 2y/p, that is to say that A^ is an admissible 
order. Writing = km"^ = Y\^t^^, we clearly have that ve{m) < \ h^/2\. Furthermore, since 
p = 1 (modm), we also have that Vf{p — 1) > Vf{m) for each C. \ m. Thus, we may take 
bt = Ve{m) in Lemma [2.11 for all i \ m. So, in particular, hi — bi = Ve{m) + Vg{k), and we 
conclude that 

Gm,k = n (^/^"'^""^^ X z/r^^^^+^^^'^^z) 

e 

is an admissible group. This completes the proof of the lemma. □ 

The fact that the groups Gm,k are more likely to occur when m is small can be seen 
using the Cohen-Lenstra heuristics which predict that random abelian groups "naturally" 
occur with probability inversely proportional to the size of their automorphism groups. In 
particular, those groups which are "nearly" cyclic are the most likely to occur. 

In order to see that the probability of occurrence of the groups Gm.,k is really in corre- 
spondence with the weights suggested by the Cohen-Lenstra heuristics, one should count 
the number of times a given group Gm,k occurs as E{¥p), and not only if it occurs. More 
precisely, given a group G of order N and a prime p, let 

Mp{G) ■.= 4^{E/¥p:E{¥p)^G}. 
The quantity in question then is the sum 

M{G) := J2 KiG). 

N-<p<N+ 

Using the proper generalization of Deuring's work, M{G) can be related to a certain average 
of Kronecker class numbers. See |13j. It is shown in [B] that, under a suitable hypothesis for 
the number of primes in short arithmetic progressions, 

^^'^"''^ KiGm,k) ■ nf^rJ^ , ■ N^'^ {N = m% m < (logA;)^, k -> oo), (2.1) 



A^/\ogN ' ' ' #Aut(G^,fc; 

where K{Gm,k) is non-zero and uniformly bounded for all integers m and k. So we see that 
the average frequency of occurrence of groups of elliptic curves over finite fields is compatible 
with the Cohen-Lenstra heuristics. 
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As we mentioned above, the results of [6] are conditional under some hypothesis for the 
number of primes in short arithmetic progressions because the intervals (A^~, A^"*") are so short 
that even the Riemann hypothesis does not guarantee the existence of a prime. Nevertheless, 
it is possible to obtain unconditional results displaying the Cohen-Lenstra phenomenon, by 
showing that the asymptotic in fl2.ip is an upper bound for all groups G, and a lower bound 
for most of the groups G (modulo constants). This work is in progress [4]. The proof of 
the lower bound for most of the groups G has similarities with the proof of Theorem 11.41 
of the present paper and, in particular, it requires the generalization of Selberg's theorem 
about primes in short arithmetic progressions due to the third author [9j, but it involves 
more technical difficulties, as one needs to combine this with the arguments of [6]. 

3. Auxiliary results 

In this section, we collect some technical results that will be needed to prove the theorems. 
First, we state the fundamental lemma of the combinatorial sieve (see, for example, [T6| 
Theorem 3, p. 60]), which will be used in the proof of Theorem ll.3[ Given a finite set of 
integers A and a number ?/ > 1, we set 



As is customary, we assume that there is a multiplicative function p and a number X such 
that for every integer d 



for some real number Rd, which we think of as an error term. Then we have the following 
result. 

Lemma 3.1. Let A, p, X and {Rd : G N} be as above. If pip) < min{2,p — 1} for all 

primes p, then we have that 



uniformly for all y > 1 and u > 1. 

The next lemma will be used in the proof of Theorem II. 3[ 

Lemma 3.2. Fix e > and let x be a non-principal character mod q. For every y > 1, we 
have that 



S{A,y):=i^{aeA:P-{a)>y}. 



#{a eA:a = (modd)} = X ■ 



p{d) 



d 





Proof. Mertens's estimate implies that 




Moreover, by the discussion in P, p. 123], we have that 



n<x 




(3.1) 



5 



using the trivial bound (3 < 1 — c/ {q^^'^ log q) for the Siegel zero provided by the class number 
formula. Partial summation then implies that 

l^exp{gi/2+£}<^<y ^ ^ j £|n^oxp{gi/2+£}<£<j, 

^ /^^ ^ + 1 < 1, 
n logn 

which completes the proof of the lemma. □ 

The next lemma, which is essentially due to Elliott, allows us to bound the value of L(l, x) 
by a very short product for most quadratic characters x- 

Lemma 3.3. Let 6 e (0, 1] and Q > 3. There is a set Ss{Q) C Z n [1,Q] of size < 
such that if X is a non-principal, quadratic Dirichlet character modulo some q < Q and of 
conductor not in Ss{Q), then 



n (i-^) iz>y>V^)- 



y<i<z 

Proof. We borrow from the proof of Proposition 2.2 in [8], which is essentially due to Elliott. 
Without loss of generality, we may assume that Q is large enough. By Theorem 1 in [lOj , 
for every ao G [4/5,1], Q > 2 and T > 1, there are < (Q2T)2{i-'^o)M,(iog q)14 primitive 
characters of conductor below Q whose L-function has a zero in the region {s = a + it E 
C : a > ctq, \t\ < T}. Let £s{Q) be the set of conductors corresponding to these exceptional 
characters with ao = 1 — 6/12 > 11/12 and T = Q^. If x is a Dirichlet character mod 
q G [l,Q] of conductor not in Ss{Q), then L{s,x) has no zeroes in {s = a + it E C : a > 
1 - 6/12, \t\ < Q^. So by ^ eqn. (17), p. 120] applied with T = min{Q^x}, we find that 

y Ain)xin) « x'-'^'' log' x + + log' Q «, + log^ Q (2 < x < e«) . 

^-^ Q-^ log X 



n<x 




The above estimate also holds for x > e*^ by (13. ip . Together with partial summation, this 
implies that 

^ — ^ nlogra ^-^ nlogn 

£\n^y<i<z ^ y<n<z ^ 

for z > y > log^ Q, that is to say, the lemma does hold in this range of y and z. Finally, if 
A/log Q <y< log^ Q, then setting w = min{z, log^ Q}, we have that 

y<l<z ^ ^ y<£<w ^ ^ w<e<z 

by (13. 2p and Mertens's estimate, and the lemma follows. □ 



Next, we state the Bombieri- Vinogradov theorem [3l [HI [I5], which will be used to prove 
Theorem 11.51 
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Lemma 3.4 (Bombieri- Vinogradov) . Let A > be fixed. Then there exists a B = B{A) > 0, 
depending on A, such that 



max 

5<a:i/2/(logx)S (a,f)=l 



n{y;q,a) 



X 



(logx) 



Finally, in order to prove Theorem ll.4[ we need the following short interval version of the 
Bombieri- Vinogradov theorem, due to the third author [9]. 

Lemma 3.5. Fix e > and A>1. For x > h > 2 and I < < h/x^^^^^ , we have that 



p2x 

I y max 



tp{y + h;q,a) -ip{y;q,a) 



dy < 



xh 



(logx)^ 



4. Proof of Theorem 11.31 
By Corollary \2.2\ we readily have that 

k<K \j\<2Vk 

where 

Sk,j '■= # {fn < M : krn^ + jm + 1 is prime} . 

Using the combinatorial sieve to bound 5*^^, one immediately obtains as in |2], that for any 
fixed K, ^S{M, K) <^k M / log M . By keeping track of the dependence on j, k and summing 
we will prove Theorem 11.31 

In the notation of Lemma [3.11 let A = {km^ + jm + 1 : m < M}, and note that 

#{a G ^ : a = (mode/)} = #{m < M : A;m^ + jm + 1 =0 (mode?)} 

= M-^ + 0(p,,(d)), 

where 

p^^ .[d) = # {c G Z/rfZ : kc^ +JC+1 = O(modrf)} . 

The Chinese remainder theorem implies that pj^k is a multiplicative function. Moreover, by 
a straightforward computation, we find that 

[(¥)' if ^ = 2, 

p,^^.(£)= Jl+(i^) if £t A: and £^2, 

[(?) if^l^^ 
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for all primes t. Since S^j < S{A, y) + y for all y, applying Lemma [3. II with y = M^/^ and 
u = 1 yields the estimate 



e 



«M n (i-^i n h- ^^'/ ' I +M^/^iogM 



i\k,i<y \ I t\k,e<y 



logM (j){k) A^J- I f I 

This implies that 



^ k<K,j<2Vk ' i^<y \ J 

Observing that — 4k E [— 4K, —1] for j and /c as above, we fix c/ G [1,4^] and seek a 
bound for the sum 

p—4k=—d p-Ak=-d 

First, note that 

n n E ]}<M^}«'^ 

by Mertens's estimate and the fact that k has at most distinct prime factors. Therefore, 

n0^9« n i^^])^ E ^. 

e\k ^ ^ £|fc,£<VlHiX ^ ^ a|fc 

P+(a)<VI^fTr 



So 



E ^ E 12 E ^ E 1 

P+(a)<VE^ k<K,\3\<2s/k P+(a)<(logA')i/2 |i|<2v^ 

a\k,j^-4k=-d 4a\j^+d 

« E — + 1 

P+(a)<{logft')i/2 \ / 

smce a < e'^^v^^) <^ for all square- free integers a with -P^(a) < ^/[ogK. Consequently, 
*^<^'-*'' « llf E n fl - ^) + M-/^A-/^logM 



Using Lemma [3.31 on truncated products of L-functions with 5 = 1/4 and Q = 4K, we find 
that there is a set £ of 0{K^^^) integers in [1, AK] such that if d G [1, 4:K] and the conductor 
of (— ) is not in £, then 

n (^""^j^^ (tt^2 >w,> viog(4ir)). 

<1<W2 \ / 



wi 

So for such a d we find that 



£<y \ / e<z \ / 

where z = min{y, ^y\og{AK)} . For the exceptional (i's, we write —d = —a?di, where di 
denotes the conductor of (— ) and note that 



1 3/4 



by Lemma I3.2[ Hence, 



(-d\\ I t ^dia^ 



d<4K l<y 
cond((^))ef 



a 



dies 



i< 



\a\<y/iK/\di\ 



dies 

The above relation and (14. 2p then imply that 



In order to control the above sum, we proceed by expanding the product to a sum and 
inverting the order of summation. We have that 

d<4:K i<z \ J P+{a)<z d<4K ^ ^ 

If a = 1, the inner sum is 4K + 0(1); else, it is ^ a. So 

a!<4i^£<z \ / P+(a)<z 

Inserting the last estimate into (14. 3p . we obtain the inequality 

i^S{M, K) « 



logM 
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which completes the proof of Theorem ll.3[ 



5. Proof of Theorem 11.41 

Define 

R{M, K) := {M/2 < m < M, K/2 < k < K : there is no prime p = 1 (modm) in Im'^k}- 

First, we prove an intermediate result for the cardinality of R{M,K). 

Theorem 5.1. Fix A > 1 ande>0. If M < K^/^-', then 

MK 

Proof. Set h = My/K and 



E{y,h;q,a) 



ij{y + h]q,a) -ij{y;q,a) - 



h 



0(g) 



and note that if the pair (m, k) G R{M, K), then 



E{{mVk - If, h- m, 1) > — ^ > — x 

(him) m 



Consequently, 



K 

M/2<m<M K/2<k<K 

Next, observe that {mVk - 1)^ e J := [M^K/10, M^K]. We cover the interval J by 
^ {M'^Ky/^ subintervals Jr of length {M'^KY^^ each. If {m\/k — 1)^ G J,., then for every 
y G Jr we have that 

E(y,h;m,l) - E{{my/k - if ,h]m,l) < ^"^^^^('^^) + ^/^ ^ j^, y ( + /i) : p = 1 (modm)} 

0(m) 

0(m) 

by the Brun-Titchmarsh inequality. So 

E{{mVk - If, h; m, 1) = [ E{y, h; m, l)dy + O { ^^^^'^ ^ 

1 f (M^Kf/^ 
^7T7TT7^m E{y,h-m,l)dy+^ 



{M^Xy/^ Jj^ ' ' ^ " ' 0(m) ' 

and consequently, 

^ M/2<m<M Jr I •> Jr ^\ / / K/2<k<K 

m^k£Jr 
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For every fixed m G [M/2, M] and every fixed interval Jr, there are at most ^ {M'^KY^^ /M'^ 
values of k with (my/k — 1)^ G Jr- Therefore we deduce that 



M/2<m<M Jr 



0(m) ) M2 



Since M < K^^^ ^, we have that 

, . M^/K 
M < 

- (M2ir)l/6+./2' 

and we can apply Lemma 13.51 to get that 



A/2/(f (logA-)-* (log/f)-"' 
thus completing the proof of Theorem I5.1[ □ 

Proof of Theorem\r^ Let 1 < M < K^/^-'. Clearly, 

#{m < M, k < K : there is no prime p=l (modm) in Im^k} < E #-^(2", 2^). 

2°<2M,2''<2X 

If 2^ < then we use the trivial bound #/2(2'',2^) < 2"+^ Otherwise, we have that 

2a < < 2^(1/4-^/2)^ Theorem O implies that #i?(2",2'') 2''+V&^. Conse- 

quently, 

4^{m < M, k < K : there is no prime p = 1 (modm) in 7^2^} 
a+b \^ 2'^+'' MK 

2<^<2M 2<^<2M ^ ^ 

26<^l-f _fs:i-^<2''<2/^ 

and Theorem 11.41 follows. □ 

6. Proof of Theorem 11.51 

Note that the primes 2 and 3 are always contained in S{M,K), since Ji = (0,4). So 
^S{M, K) > 2, and consequently, we may assume without loss of generality that K is large 
enough. Also, we may assume that M is an integer, so that the interval (3M/ 4, M] always 
contain integers. 

Proposition 12.21 implies that 

#S{M,K)= J2 

m<M k<K 

where 



I(m, k) 



1 if there exists a prime p G Im?k such that p= \ (modm) 
otherwise. 
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Now, note that 

I(m, k) > I ' ■ # {p G : p = 1 (modm)} , 

by the Brun-Titchmarsh inequahty. Therefore we deduce that 

#S(M.A-)»!25^ ^ ^ 5^ 1 

JK rn ^-^ 

^ ■iM/A<m<M P^^m^k 

K/5<k<K p=l(modm) 



NPK/4:<p<KPK/3 3M/4<m<M K/5<k<K 
p=l{modm) P^^m'ik 

by switching the order of summation and restricting p in the interval {M'^K/4, M'^K/3]. Fix 
p and m as in (16. ip and note that if k is an integer for which p G Im^k, then we necessarily 
have that K/5 < k <K. So 

p-2^+1 P + 2^+l\ Jp^y/K 



K/5<k<K fcgZ:pe/„2fe 



j: I- j: i=#^.z: " <*< 



> 



smce 



A^M^K/A _ 2^fK_ 



m 



2 



M2 M 



by our assumption that M <\/ K. Consequently, 

#s(M,/o»i^ E E ^ 



M ^ ^ m 

M^K/A<p<NPK/'i 3M/4:<m<M 
p=l (mod m) 

^ ^(vr(M^ir/3;m,l)-7r(M^ir/4;m,l)) 

3Af/4<m<M 

log^ ( V- (/>(m) li(M^ir/3) - \i{M^K/A) \ 
M \ ^ m (bim) )' ^ ' ' 

\3M/4<m<A/ -fV y / 



where 



V- /,.2../ X ^..2r.,. ^ h(M2K/3) -h(M2K/4)\ 

The sum of the main term in fl6.2p is 

^ m ^ ^ M\og(M^K) ^ hgK' 

3M/4<m<Af 3A//4<m<Af ^ ^ 
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It is in this step that we need that the interval (3M/4, M] contains an integer. Furthermore, 
we have that 



3M/4<m<M 



2 1 / 2r^/o ^„ 1N h(M2i^/3) - h(M2ir/4) 



Ti{M'K/A] m, 1) - tt{M^K/3; m, 1) - 



by Lemma I3.4[ Combining the above estimates, we find that there is an absolute constant c 
such that 

#S(M,K)>cMK^o(^)>'^''"' 



logK J - 2 ' 

provided that K is large enough. This completes the proof of Theorem 11.51 
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